Network evasion detection with Bi-LSTM model

Network evasion is a way to disguise data traffic by confusing network intrusion detection systems. Network evasion detection is designed to distinguish whether a network traffic from the link layer poses a threat to the network or not. At present, the traditional network evasion detection method does not extract the characteristics of network traffic and the detection accuracy is relatively low. In this paper, a novel network evasion detection framework has been proposed to detect eight atomic evasion behaviors which are based on deep recurrent neural network. Firstly, inter-packet and intra-packet features are extracted from network traces. Then a bidirectional long short-term memory (Bi-LSTM) neural network is trained to encode both the past and the future traits of the network traces. Finally, on the top of the Bi-LSTM network, a Softmax layer is used to classify the trace into the correct evasion class. The experimental results show that the average detection accuracy of the framework reaches 96.1%.